CVE-2024-31861

{"id": "CVE-2024-31861", "metrics": {}, "published": "2024-04-11T09:15:08.320", "references": [{"url": "http://www.openwall.com/lists/oss-security/2024/04/10/8", "source": "security@apache.org"}, {"url": "https://github.com/apache/zeppelin/pull/4708", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/99clvqrht5l5r6kzjzwg2kj94boc9sfh", "source": "security@apache.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin.\n\nThe attackers can use Shell interpreter as a code generation gateway, and execute the generated code as a normal way.\nThis issue affects Apache Zeppelin: from 0.10.1 before 0.11.1.\n\nUsers are recommended to upgrade to version 0.11.1, which doesn't have Shell interpreter by default.\n\n"}, {"lang": "es", "value": "Vulnerabilidad de control inadecuado de generaci\u00f3n de c\u00f3digo (\"inyecci\u00f3n de c\u00f3digo\") en Apache Zeppelin. Los atacantes pueden utilizar el int\u00e9rprete Shell como puerta de enlace de generaci\u00f3n de c\u00f3digo y ejecutar el c\u00f3digo generado de forma normal. Este problema afecta a Apache Zeppelin: desde 0.10.1 antes de 0.11.1. Se recomienda a los usuarios actualizar a la versi\u00f3n 0.11.1, que no tiene int\u00e9rprete de Shell de forma predeterminada."}], "lastModified": "2024-05-01T18:15:23.450", "sourceIdentifier": "security@apache.org"}